# fail2ban cheat sheet

> Printable fail2ban cheat sheet: service control, status, ban and unban, ignoreip, runtime get/set, logs, fail2ban-regex tests, file paths, time units and jail.local.
>
> Source: https://fail2ban.dev/cheat-sheet/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

This fail2ban cheat sheet covers the commands you use most: `fail2ban-client status <jail>` to see bans, `set <jail> unbanip <IP>` and `set <jail> banip <IP>` to change them, `reload` after editing `/etc/fail2ban/jail.local`, and `fail2ban-regex` to test filters. Settings go in `jail.local`, never `jail.conf`. All commands below need `sudo`.

## Service control (systemd)

| Task | Command |
|---|---|
| Start / stop | `systemctl start fail2ban` / `systemctl stop fail2ban` |
| Restart the service | `systemctl restart fail2ban` |
| Reload config | `systemctl reload fail2ban` or `fail2ban-client reload` |
| Start at boot | `systemctl enable --now fail2ban` |
| Is it running? | `systemctl status fail2ban` or `fail2ban-client ping` |
| Service log | `journalctl -u fail2ban -e` |

## Status

| Task | Command |
|---|---|
| List jails | `fail2ban-client status` |
| One jail (failures, bans, IPs) | `fail2ban-client status sshd` |
| All jails at once (1.1.0+) | `fail2ban-client status --all` |
| Summary table (1.1.0+) | `fail2ban-client stats` |
| Version | `fail2ban-client --version` |

```text
$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed:	2
|  |- Total failed:	6
|  `- File list:	/var/log/auth.log
`- Actions
   |- Currently banned:	1
   |- Total banned:	1
   `- Banned IP list:	203.0.113.42
```

## Ban and unban

| Task | Command |
|---|---|
| Ban an IP in a jail | `fail2ban-client set sshd banip 203.0.113.42` |
| Ban a subnet | `fail2ban-client set sshd banip 198.51.100.0/24` |
| Unban from one jail | `fail2ban-client set sshd unbanip 203.0.113.42` |
| Unban from all jails + database | `fail2ban-client unban 203.0.113.42` |
| Unban everything | `fail2ban-client unban --all` |
| Restart a jail, drop its bans | `fail2ban-client restart --unban sshd` |

`banip`/`unbanip` print a number: how many addresses changed (`1` = done, `0` = nothing to do). Guides: [unban an IP](/unban-ip/), [ban an IP manually](/ban-ip/).

## List banned IPs

| Task | Command |
|---|---|
| All jails, as a list | `fail2ban-client banned` |
| Which jail banned this IP? | `fail2ban-client banned 203.0.113.42` |
| One jail, space-separated | `fail2ban-client get sshd banip` |
| One jail, with ban/expiry times | `fail2ban-client get sshd banip --with-time` |
| One per line | `fail2ban-client get sshd banip | tr ' ' '\n'` |
| In nftables | `nft list set inet f2b-table addr-set-sshd` |
| In iptables | `iptables -L f2b-sshd -n` |

More: [list banned IPs](/banned-ips/).

## Whitelist (ignoreip)

```ini
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.10
```
|---|---|
| Show ignore list | `fail2ban-client get sshd ignoreip` |
| Add at runtime | `fail2ban-client set sshd addignoreip 192.168.1.0/24` |
| Remove at runtime | `fail2ban-client set sshd delignoreip 192.168.1.0/24` |

Runtime changes are lost on reload. Details: [whitelist IPs with ignoreip](/config/whitelist/).

## Read and change settings at runtime

| Task | Command |
|---|---|
| Ban time (seconds) | `fail2ban-client get sshd bantime` |
| Set ban time | `fail2ban-client set sshd bantime 1d` |
| Find time / max retry | `get sshd findtime`, `get sshd maxretry` |
| Set max retry | `fail2ban-client set sshd maxretry 3` |
| Monitored logs | `fail2ban-client get sshd logpath` |
| Journal match | `fail2ban-client get sshd journalmatch` |
| Actions in use | `fail2ban-client get sshd actions` |
| Pause a jail | `fail2ban-client set sshd idle on` |

## Reload and test

| Task | Command |
|---|---|
| Test config | `fail2ban-client -t` |
| Dump merged config | `fail2ban-client -d` |
| Reload all jails | `fail2ban-client reload` |
| Reload one jail | `fail2ban-client reload sshd` |
| Full restart, clear all bans | `fail2ban-client reload --restart --unban` |

When to use which: [restart vs reload](/reload/).

## Logs

| Task | Command |
|---|---|
| Follow fail2ban's log | `tail -f /var/log/fail2ban.log` |
| Bans only | `grep '\] Ban ' /var/log/fail2ban.log` |
| Top banned IPs | `grep -oP '\] Ban \K\S+' /var/log/fail2ban.log | sort | uniq -c | sort -rn | head` |
| Log level | `fail2ban-client get loglevel` / `set loglevel DEBUG` |
| Log target | `fail2ban-client get logtarget` |

```log
2026-10-25 18:36:11,027 fail2ban.actions        [1997]: NOTICE  [sshd] Ban 203.0.113.42
```

## Test filters with fail2ban-regex

| Task | Command |
|---|---|
| Jail/filter vs log file | `fail2ban-regex /var/log/auth.log sshd` |
| Filter file | `fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf` |
| systemd journal | `fail2ban-regex systemd-journal sshd` |
| Inline regex | `fail2ban-regex /var/log/auth.log 'Failed password for .* from <HOST>'` |
| Show matched lines | add `--print-all-matched` |
| Only the IPs | add `-o ip` |
| Filter mode | `fail2ban-regex /var/log/auth.log 'sshd[mode=aggressive]'` |

Full guide: [fail2ban-regex](/fail2ban-regex/). Or paste lines into the [online regex tester](/tools/regex-tester/).

## Files and paths

| Path | What it is |
|---|---|
| `/etc/fail2ban/jail.conf` | Stock jails and defaults — don't edit |
| `/etc/fail2ban/jail.local` | Your overrides (create it) |
| `/etc/fail2ban/jail.d/*.conf`, `*.local` | Drop-in jail files (distro defaults live here) |
| `/etc/fail2ban/fail2ban.conf` / `.local` | Server settings: log, socket, database |
| `/etc/fail2ban/filter.d/` | Filters (regexes) |
| `/etc/fail2ban/action.d/` | Actions (firewall commands, mail…) |
| `/etc/fail2ban/paths-*.conf` | Distro log paths and default banaction |
| `/var/log/fail2ban.log` | fail2ban's own log |
| `/var/lib/fail2ban/fail2ban.sqlite3` | Ban database |
| `/var/run/fail2ban/fail2ban.sock` | Client–server socket |

Load order: `jail.conf` → `jail.d/*.conf` → `jail.local` → `jail.d/*.local`. Later files win.

## Time units

| Write | Means |
|---|---|
| `600` | 600 seconds (plain numbers are seconds) |
| `30s`, `10m`, `1h` | seconds, minutes, hours |
| `1d`, `1w` | day, week |
| `1mo`, `1y` | month, year (`m` is minutes, so month is `mo`) |
| `1d12h` | combinations add up (129600 s) |
| `-1` | forever (`bantime = -1` = permanent ban) |

Check any value with `fail2ban-client --str2sec 1d12h`. Pick ban times with the [bantime calculator](/tools/bantime-calculator/).

## Minimal jail.local

```ini
[DEFAULT]
# never ban yourself
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24
bantime  = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
# Debian 12 has no /var/log/auth.log by default:
# backend = systemd
```

## FAQ

### What are the most important fail2ban commands?

`fail2ban-client status` lists jails, `fail2ban-client status sshd` shows bans for one jail, `fail2ban-client set sshd unbanip <IP>` removes a ban, `fail2ban-client set sshd banip <IP>` adds one, and `fail2ban-client reload` applies config changes. `fail2ban-regex` tests filters against your logs.

### How do I check if fail2ban is working?

Run `sudo fail2ban-client ping` (it answers `Server replied: pong`), then `sudo fail2ban-client status sshd`. A rising `Total failed` count means the filter is matching log lines; a non-zero `Total banned` means bans are happening. `tail /var/log/fail2ban.log` shows `Found` and `Ban` lines as they occur.

### How do I make fail2ban ban forever?

Set `bantime = -1` for the jail in `jail.local` and reload. For repeat offenders only, enable the `recidive` jail or `bantime.increment` instead, so first-time typos still expire. Permanent bans are kept in the database and restored after a restart.